Deny Delete permission not working

[Admiral208]

Im trying to set up some folders with customised permissions in order to create a work 'hand in' area.

 

It works perfectly except for one thing.

 

This is the basic folder structure where the problem lies...

 

Folder1 - studentuser1 has modify permission for subfolders and files.

--subfolder1 - Inheritance has been broken. studentuser1 has read and execute. Delete is denied.

 

 

Here's the problem. Studentuser1 can still delete subfolder1 if its empty. If there is a file in there, they cannot delete the file and therefore the folder. I thought that an explicit deny took precedence over an explicit allow.

 

Am I missing something really obvious?? How do I stop studentuser1 from deleting subfolder1 whilst allowing them to create and delete files and folders in Folder1?

 

Thanks

 

James

[Steve21]

Seems to be working fine here.

 

Unless I'm missing some permissions you've set (As based on the above they wouldn't be able to write into the folder etc)

 

But if I give a student access as follows:

 

StudentFolder - Modify

SubFolder - Block inheritance + Read/Execute, and deny delete

 

It stops them deleting it.

 

 

That's how you mean right?

 

What other permissions do you have set though, as that wouldn't give write access to the folders etc

 

Steve

[AngryTechnician]

If you use the Advanced dialog you can set a Deny Delete permission on Folder1 and apply it to subfolders only. I think that should achieve what you need.

[Steve21]

If you use the Advanced dialog you can set a Deny Delete permission on Folder1 and apply it to subfolders only. I think that should achieve what you need.

 

I may be being dumb, but that would give same outcome surely? If for whatever reason one is being overriden, wouldn't it most likely be a full-control or something being inherited from higher up?

 

Surely a deny on a folder, or a deny on subfolders one level up is identical? (As I said, I may be being dumb )

 

Steve

[SYNACK]

I may be being dumb, but that would give same outcome surely? If for whatever reason one is being overriden, wouldn't it most likely be a full-control or something being inherited from higher up?

 

Surely a deny on a folder, or a deny on subfolders one level up is identical? (As I said, I may be being dumb )

 

Steve

 

Deny overrides allow though so a full control would not cause it.

[Steve21]

Deny overrides allow though so a full control would not cause it.

 

Not on a higher level. Having full control on Student1 Folder, would override deny on Subfolder?

 

Steve

[Steve21]

Example to the above:

 

 

Doesn't matter what permission you put on the subfolder, as you have full control on the higher folder, so can delete anything below it.

 

Steve

[DavidTomic]

Deny overrides allow though so a full control would not cause it.

 

No ... The normal hierarchy for NTFS permissions is:

 

 

• Explicit Deny
  
• Explicit Allow
  
• Inherited Deny
  
• Inherited Allow
  

 

Those rules are checked (from top to bottom) and the first match it finds are the permissions that get applied to the affected object(s).

 

The *ONE* exception to normal behaviour, is if they've been granted FULL CONTROL of the parent folder, which is where your problem is stemming from.

 

(Since they've been given full control of the (parent) directory, any child permissions are basically irrelevant because they've got full access to modify the underlying permissions anyway)

 

You don't want students being able to modify/change security permissions (which Full Control obviously allows them to do) so should *NEVER* grant students Full Control of *ANYTHING* ...

 

Granting them MODIFY access gives them full control over everything *EXCEPT* changing security permissions, which is what you should be setting instead.

 

It also solves the problem you're having with them being able to delete things which they're not supposed to.

 

Edited January 21, 2013 by DavidTomic

[Steve21]

The *ONE* exception to normal behaviour, is if they've been granted FULL CONTROL of the parent folder, which is where your problem is stemming from.

 

(Since they've been given full control of the (parent) directory, any child permissions are basically irrelevant because they've got full access to modify the underlying permissions anyway)

 

Which is what I said?

 

If you have full control on Student1 folder, the permissions on the subfolder don't matter.

 

As per MS:

IMPORTANT: Groups or users who are granted Full Control on a folder can delete any files in that folder regardless of the permissions that protect the file.

 

Steve

[DavidTomic]

 

If you have full control on Student1 folder, the permissions on the subfolder don't matter.

 

Which is exactly why you *DON'T* grant Full Control permissions in the first place ...

 

EDIT - I just updated my last post to (hopefully) make things a little bit clearer. Does that help at all?

Edited January 21, 2013 by DavidTomic

[Steve21]

Which is exactly why you *DON'T* grant Full Control permissions in the first place ...

 

I think you're misunderstanding the whole point to what I said above...

 

If you read what I said I'm explaining that it shouldn't matter if you deny permissions on a folder, or do it to the parent via subfolder deny, as long as it's not overrided by any full control.

[DavidTomic]

I think you're misunderstanding the whole point to what I said above...

 

If you read what I said I'm explaining that it shouldn't matter if you deny permissions on a folder, or do it to the parent via subfolder deny, as long as it's not overrided by any full control.

 

Sorry ... I understand EXACTLY what you're saying, and you're absolutely correct.

 

When I read your post I had you mixed up with the OP who was actually having the problem to begin with.

[Steve21]

Sorry ... I understand EXACTLY what you're saying, and you're absolutely correct.

 

When I read your post I had you mixed up with the OP who was actually having the problem to begin with.

 

Ah lol.

 

No idea if there are any Full Controls etc involved on Admirals end, but that's only way I can see for it to not be working as expected. Unless there's some extra permissions coming into play from "somewhere" or just my test missing something obvious.

 

Guess we'll have to wait for Admiral

 

Steve

[Admiral208]

Thanks guys. so when i said they have modify permissions, what I actually meant was they have special permissions which I thought was equivalent to modify.

 

It appears that the permissions are not quite the same. They are set to allow delete subfolders and files rather than delete, like you would get in Modify.

 

 

Ive set it like this to protect Folder1 from being deleted also.

 

Any suggestions?

[Steve21]

Thanks guys. so when i said they have modify permissions, what I actually meant was they have special permissions which I thought was equivalent to modify.

 

It appears that the permissions are not quite the same. They are set to allow delete subfolders and files rather than delete, like you would get in Modify.

 

[ATTACH=CONFIG]16807[/ATTACH]

 

Ive set it like this to protect Folder1 from being deleted also.

 

 

Any suggestions?

 

If you set that on Folder1 (Not sub) it'd stll let the subfolder be deleted though, which I'm assuming you don't want?

 

Steve

[Admiral208]

If you set that on Folder1 (Not sub) it'd stll let the subfolder be deleted though, which I'm assuming you don't want?

 

Steve

 

Exactly. I want to protect subfolder1 and Folder1 from being deleted.

[Steve21]

Exactly. I want to protect subfolder1 and Folder1 from being deleted.

 

Put a bog standard Modify permission on Folder1 inherited to SubFolder. Then add a manual "Delete" deny to both for that folder only.

 

You don't need to add permissions to delete stuff that's already included under the modify.

 

Then Folder1 and SubFolder can't be deleted, everything else can (Or should do I'll test it quickly)

 

Steve

[Steve21]

 

Can't delete Folder1, or subfolder. But can add/delete any other files/folders under that, working here as tested. But as always please check it's as you want, before putting it live

 

Steve

[DavidTomic]

 

Any suggestions?

 

It shouldn't be hard to get it working properly, but it really just depends on exactly what you're actually trying to achieve.

 

I have something fairly similar configured, which I've basically got setup as follows:

 

Students - Read & Execute (This Folder Only)

(Which means that the root folder is essentially read only as far as the students are concerned. They can't create/modify/delete anything at the root level.)

 

Students - Read, Write & Execute (Subfolders only)

(The idea being that the teacher creates a (sub)folder [iE: English Assignment], which the students then have permissions to save/write to as needed.

NOTE: They can write INTO the folder, but they can't actually modify/delete the folder itself, which is basically what you want, right?)

 

Creator Owner - Modify

(Students can modify/delete their OWN files, but not the files of any other users)

 

I'm not sure how well that meshes with what you're actually trying to achieve, but it might at least help set you on the right path ...

Edited January 21, 2013 by DavidTomic

[Admiral208]

Bingo!! Thanks steve. This is all on test folders anyway. Ive just tried it and it seems to work. Ill test it properly now and then I will make the changes to a script which will hopefully automate this folder creation.

 

Thanks again

[Steve21]

Bingo!! Thanks steve. This is all on test folders anyway. Ive just tried it and it seems to work. Ill test it properly now and then I will make the changes to a script which will hopefully automate this folder creation.

 

Thanks again

 

Aye, just thought best to say before I get shouted at for breaking a school!

 

Back to blowing things up! Shout if it doesn't work properly.

 

Steve